The vulnerability in the Linux kernel’s xprtrdma subsystem occurs when the function rpcrdma_post_recvs exits early—such as after a memory allocation failure—without decrementing the re_receiving counter. Because the counter never reaches zero, the rpcrdma_xprt_drain routine stalls indefinitely, causing a kernel worker task to hang and the system to become unable to process RDMA‑based RPC traffic. This results in a local denial‑of‑service manifested by hung kernel tasks and degraded system responsiveness. The weakness is one of resource leakage, classified as CWE‑667 and CWE‑772.

The defect is present in any Linux kernel build that includes the xprtrdma RPC transport, specifically affecting kernels from 6.18 up to and including the 7.0‑rc3 release stream as indicated by the listed CPE ranges. Any kernel compiled with this component and lacking the corresponding patch is potentially affected.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is unlikely under normal conditions. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local; an attacker would need to induce a high‑memory condition or trigger an allocation failure within rpcrdma_post_recvs, which generally requires elevated privileges or the ability to run privileged kernel modules. Once triggered, the denial of service is confined to the local system as the hung kernel task does not affect external network traffic.